Is partial quantum search of a database any easier? 
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Abstract. We consider the partial database search problem where given a quantum database {0, 1}™ — ► {0, 1} 
with the condition that f(x) = 1 for a unique x G {0, 1}", we are required to determine only the first k bits 
of the address x. We derive an algorithm and a lower bound for this problem. Let q(k, n) be the minimum 
number of queries needed to find the first k bits of the required address x with certainty (or with very high 
probability, say 1 — 0(N~~)). We show that there exist constants (corresponding to the algorithm) and dk 
(corresponding to the lower bound) such that 

where K — 2 k and N = 2™. Our algorithm returns the correct answer with probability 1 — 0(l/\/~N), and 
can be easily modified to give the correct answer with certainty. The lower bound for algorithms that return 
the correct answer with certainty is proved by reducing the usual database search problem to this partial search 
problem, and invoking Zalka's lower bound showing that Grovers algorithm is optimal for the usual database 
search problem. We then derive a lower bound that is applicable for database search algorithms that err with 
small probability, and use it to show that our lower bound also applies to partial search algorithms that return 
the correct answer with probability at least 1 — 0(N~*). Thus, it is easier to determine some k bits of the 
target address than to find the entire address, but as k becomes large this advantage reduces rapidly. 
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1 Introduction 



In the database search problem, we are required to determine the address where a given item is stored. 
In this paper, we consider a variant of the problem, where we do not want the entire address but only its 
first k bits. The motivation for considering this problem is that quite often in real databases, just a small 
part of the target address contains all the information we need. For example: the items in a database may 
be listed according to the order of preference (say a merit-list which consists of a ranking of students in 
a class sorted by the rank). We want to know roughly where a particular student stands — we might want 
to know whether he/she ranks in the top 25%, the next 25%, the next 25%, or the bottom 25%. In other 
words, we want to know the first two bits of the rank and since the list was sorted by rank, we need just 
the first two bits of the address. 

1.1 Partial classical search is easier 

First consider classical algorithms. We will assume that our algorithms make no errors. Using a simple 
randomized classical search algorithm one can find an element in such a database using, on an average, 
Y queries (N is the number of elements in the database). This bound is tight if we wish to to determine 
the location of the element exactly. 

Now, consider partial search. That is, the range {1,2,..., N} into K equal blocks (in the example 
above, these blocks are intervals) and we are asked to determine in which of these blocks the target item 
lies. A natural algorithm for this problem is to randomly choose K — 1 of the K blocks and probe the 
locations in these blocks in some random order. If the target lies in the block that is being searched, the 
algorithm will find it; however, if it does not find the target, we come to know that it is one of the 
items that the algorithm has not probed. A simple analysis shows that the expected number of queries 
made by this algorithm is y (l — . So, this algorithm saves a little for the seemingly easier problem. 
It can be verified that no classical randomized algorithm can do better (see Appendix |A] for a proof). So, 
the savings necessarily reduce very fast as K grows. If we restrict ourselves to deterministic algorithms, 
then using the same idea we can derive an algorithm that makes only N (l — queries, a saving of ^ 
queries over any algorithm that solves the original database problem with certainty. 

1.2 Why partial quantum search may be easier 

In this paper we study this problem in the quantum setting. Again, we restrict ourselves to algorithms that 
make no error. It is well known that if the database is supplied in the form of a suitable quantum oracle, 
then it is possible to use quantum parallelism and determine the rank of any element using (^) ^/N 
queries 0]. Furthermore, this algorithm is optimal (also 111 121 ). The ideas used to speed up partial 

search classically can be used to reduce the number of queries by a factor of J « 1 — ^ over the 
standard quantum search algorithm. That is, we randomly pick K — 1 of the blocks and run the quantum 
search algorithm on the TV (l — 4-) locations in the chosen blocks. This would require 



queries. As in the deterministic classical search algorithm, the savings in the number of queries are 0(-^) 
times the number of queries needed for exact search. In the classical case, that is the best that we could 
do. In this paper, we show a better quantum algorithm that saves 6(-j=) times the number number of 
queries needed for exact search, and argue that up to constant factors this the best one can hope for. Our 
main result is the following. 
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Theorem 1. Assume that N is much larger than K. 

Upper bound: For all K there is a constant > 0, such that there is a quantum algorithm for partial 
search that makes at most (f )(1 — ck)\^N queries to the database and returns the answer with 
probability at least 1 — 0(N~^); this algorithm can be modified to return the correct answer 
with certainty while increasing the number of queries by at most a constant. For large K, we have 

r. ^ 0.42 

Lower bound: Fix K. Suppose there is a quantum algorithm for partial search that makes at most 
?(1 — dfc)\/iV queries (for all large N) and returns the correct answer with probability at least 
1 - 0(iV _ 3), then d K < -4=. 

The upper bound is obtained by judicious combinations of amplitude amplification steps used for the 
standard quantum database search problem. The lower bound is obtained by observing that an algorithm 
for the regular database search problem can be obtained by using the partial search algorithm as a 
subroutine and using lower bounds for the regular database search (for the zero-error case we can use 
Zalka [ 8 ] 's result, which we refine in order to derive our lower bounds for partial search algorithms with 
small eiTor). 



1.3 An example 
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(A) Start with the uniform superposition of the twelve states. 

(B) Invert the amplitude of the target state. 

(C) Invert about the average in each of the three blocks. 

(D) Invert the amplitude of the target state again. 

(E) Invert about the global average. 



Fig. 1. Partial quantum search in a database of twelve items 



Consider a list with twelve items. It is easily checked that to find the target with certainty, we would 
need at least three (quantum) queries. Suppose we just want to know whether the given element appears 
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in the first one-third, the second one-third or the last one-third. Can we now manage with fewer queries? 
Consider the algorithm shown in Figure ^ At the end, all the amplitude is concentrated on the target 
block. So, by performing a measurement, we can determine the target block with probability one, and, 
in fact, recover the target state itself with probability |. Note that this algorithm makes just two queries, 
for the transitions from (A) to (B) and (C) to (D). 



2 Background and notation 

Before we describe our algorithm, we review the framework for quantum search. We assume that the 
reader is familial - with the basics of quantum circuits, especially the quantum database search algorithm 
of Grover [4] (see, for example, Nielsen and Chuang [7 Chapter 6]). 



2.1 Database search 

The database is modeled as a function f : [N] ^ S, where [N] = {0, 1, 2, . . . , N - 1} is the set of 
addresses and S is the set of possible items to be stored in the database. For our purposes, we can take S 
to be {0, 1}. When thinking of bits we identify [N] with {0, 1}" . We will assume that there is a unique 
location x such that f(x) = 1. This assumption is natural and widely used when modeling the search 
problem for unsorted databases with unique keys. We will call this the target location and denote it by t. 
In the quantum model, this database is provided to us by means of an oracle unitary transformation Tf 
which acts on an (n + l)-qubit space by sending the basis vector \x)\b) to \x)\b © f(x)}. 

In the version of the quantum search algorithm useful for us (see Nielsen and Chuang |7 , Chapter 
6]), one starts with n-qubits in the uniform supeiposition 



N 

x£{0,l} n 

Then, one repeatedly applies the following operation in order to amplify the probability of the target 
state: 

A = Iolt- 

Here, the unitary transformation I t = I — 2\t)(t\ selectively inverts the amplitude of the target state, 
and Iq = 2\^o) (i/jq\ — I selectively inverts the amplitude of the component orthogonal to |^q)- One 
can implement I t using a quantum circuit that makes one query to the oracle. The state vector always 
stays in the two dimensional space spanned by |^o) an d \t). Each application of the transformation A 
moves the state vector towards the target state by an angle of about -H=. Thus, after (j)VN iterations the 
state vector reaches (very close to) the target state. One curious feature of this algorithm is that further 
applications of the transformation move the state vector away from \t) and \tpo) so that very soon its 
component along the \tpo) becomes negative. Thus, one has to choose the number of iteration carefully 
in order to optimize the probability of success. Interestingly, this drift away from the target state, which 
is usually considered a nuisance, is crucial for our general partial search algorithm. In fact, we made 
use of it in the example above. 

Quantum algorithms that make no error: Graver's database search algorithm {§j finds the location 
where an element is stored using approximately (|) \f~N queries to the oracle. The original version 
of the algorithm could return a wrong address with probability 0(1/N). (Recall that we assume that the 
element is stored at a unique location in the database.) However, it is possible to modify the algorithm so 
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that the correct answer is returned with certainty (for example, one can modify the last iteration slightly 
so that the state vector does not overshoot its target see also I3I5I6I9I ). In the next section, we present an 
algorithm for partial search that returns the correct answer with high probability. It is easy to see that this 
algorithm can be modified to ensure that the correct answer is returned with probability one. It is easy to 
reduce the usual database problem to the partial search problem considered in this paper and conclude 
from Zalka's |8) lower bound of (|) y~N that the bound we obtain are essentially optimal for partial 
search algorithms that return the correct answer with certainty. A similar lower bound applies to partial 
search algorithm whose probability of error is very small say 0(N~*). For this we need to observe that 
a version of Zalka's [8| lower bound holds even when the quantum database search algorithm errs with 
some very small probability. A referee of an earlier version of this paper pointed out that this fact is not 
explicitly stated in Zalka's paper; so, we provide a detailed derivation in Appendix iBl In Section |4j we 
show that the savings achieved by our algorithm are essentially optimal for algorithms that err with very 
small probability. 

2.2 The partial search problem 

In the partial search problem, the set of address, R, is partitioned into K equal blocks of size N/K 

each. We will then think of the addresses in R as pairs (y, z) where y E [K] = {1,2,..., K} and 
z G [N/K]. For example, when R = {0, l} n and K = 2 k , each such block could correspond to 
those addresses that have the same first k bits; then, y gives the first k bits of the address and z the 
remaining n — k bits. We refer to the block containing the target t = ytZt as the target block and the 
other blocks as non-target blocks. In our algorithm we will apply the database search iteration to the 
different blocks in parallel. This is implemented by means of an operator hm/K] which acts as follows. 
First, it applies the the operator I t defined above, to invert the amplitude of target state. Then, it performs 

an inversion about the average in each block in parallel. Formally, let \4>o,[n/k]) = ^jfj^ Ylze[N/K] \ z ) 

and I ,[N/K] = 2|'0o,[jv "/ K]) ("0o,[iv y K}\ ~ I{n/k] (where I[n/k] is the identity operator on the space of 
dimension N/K). Then, 

&[N/K] = (I[K] ® h,[N/K])h- 

Note this operator acts on the space of dimension N. With this notation, we are ready to describe our 
algorithm and the lower bound in detail. 

3 Partial search is easier . . . 

In this section, we present an algorithm that uses fewer queries to the database than the algorithm 
presented in the introduction. The goal is to use a suitable combination of operators A and Arjvyi^i so 
that, in the end, only the basis states in the target block have positive amplitude. Clearly, after this a 
measurement of the state vector with respect to the standard basis will give us the information we want. 

The algorithm has three steps, of which the first two involve amplitude amplification. In the first step, 
we use the operator A on the entire address space (of dimension N). However, we stop short of finding 

the target exactly, making 6 ^J~^J fewer queries than we would for a complete search. In the second 

step, we use the operator Arjv/ic] which does amplification in parallel in each block. The amplitudes of 
the states in the non-target blocks are not affected in this step; the states in the target block, however, 
acquire negative amplitudes. The number of iterations is chosen so that the overall average amplitude is 
exactly half of the amplitude of each state in non-target blocks. In particular, if we perform an inversion 
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Step 1: Prepare the address register in the state 



N 

x£{N] 

Perform £i(e) = (f )(1 — e)V^V iterations of the standard amplification step. The resulting state (see 
Figure fig:stepl) is 

Step 2: We perform ^(e) iterations of the Any/jr], so that the average amplitude of all the non-target 
states is exactly half the amplitude of every state in every non-target block. 

Step 3: There are two operations performed in this step. First, we move the target state out. That is, 
we take an ancilla qubit b (initially in state |0)) and perform the operation M: 

for the target state t: \b)\t) i-> |6©l)|t); 
for other basis states | x): \b)\x) i— > |6)|ai). 

Controlled on b — 0, we perform an inversion about the average. All states in the non-target blocks 
now have amplitude zero! 



Fig. 2. The algorithm for partial search 



about the average for all non-target states, the amplitude of the states in the non-target blocks will become 
zero. This inversion about the average for non-target states is implemented in the third step; it requires 
just one query to the database. It will turn out that the savings in the first step are significantly more than 
the number of queries needed to implement the second step, so that in the end we are still left with a 

savings of 9 (^J~^j queries. 

The algorithm in Figure [3]uses a parameter e that controls the number of iterations. Later, in order to 
minimize the number of queries we will need to choose e optimally. On first reading, it might be helpful 
to assume that K is a large constant and e = -k=. 



3.1 Estimating the number of queries 

Remark about approximations: In the following we will assume that N is large. To keep the presentation 
simple, we will often make approximate calculations. When we say LHS ~ RHS, we mean that the two 
sides differ by a quantity that goes to as N becomes large, say like 0(— =). For example, we sometimes 
pretend that the target state is orthogonal to the state \ipo). Our algorithm will produce the correct answer 
with probability very close to 1; the probability of error is O (^^j- However, as remarked above, one 
can modify the algorithm so that it returns the correct answer with certainty. 



Analysis of Step 1: We will write x = yz with y e [K] and z £ [N/K], as described above, and express 

|V>i) as 

y&[K] 
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Fig. 3. Step 1 moves the state vector close to the target state by performing j(l — e)\/N iterations of the 
standard quantum search 



where the a y 's are complex amplitudes whose squares sum to 1, and \ifi y ) is a state of the form 

^2 wnere E \Pyz\ 2 = 1- 

ze[N/K] z€[N/K] 



Since, 



= co S {6)\t) + 



sin(0) 



E 

x:Xy^t 



we get the following information about a y and \ip y ). (See also the first histogram of Figure 0. Recall 
that we write t = ytZt, where y t is the address of the target block and z t is the address inside the target 
block. 



In a non-target block: Suppose y y t . Then, the projection of the current state vector on the 
subspace corresponding the block of y, is a uniform superposition of the basis vectors but with 
length -7= sin(#). That is, 



sin(0); 



and \ip y 



z£[N/K] 



(1) 
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Fig. 4. Step 2 consists of independent quantum searches for each block; in the target block the state vector 
moves past the target 



In the target block: For the target block, we have 



, , , . cos(#) . . sin(0) 1 v-^ i \ 

The first term conesponds to the component along the target state; the second corresponds to the 
uniform superposition on all states in the target block. 



Analysis of Step 2: In this step, we work on each block separately but in parallel by applying the operator 
Ai N / K j described above. This operator has the following effect. The amplitudes of basis states in non- 
target blocks remain the same (i.e. S1 ^L/ ). However, the non-target basis states in the target block transfer 
their amplitude to the target state and then acquire negative amplitudes. For y ^ y t , a y and \ip y ) do not 
change. However, the projection on the subspace corresponding to the target block moves from \ip yt ) to 
ip' yt (see FigureEJ). Thus, at the end of Step 2, the overall state is 

y-v+yt 

We choose £2 so that the component of the vector \i^' yt ) along ^y^ K Yl z e[N/K] \ z ) ^ s an appropriate 
negative quantity. The histogram in Figure|5]shows the amplitudes of all the basis states before and after 
Step 2. The dotted line in the histogram is the average of all the non-target states and is arranged to be 
half the amplitude of the states in the non-target blocks. 

We are now ready to determine £2- We work in the N/K dimensional space corresponding to the 
target block. Let 9\ be the initial angle between \ip yt ) and \z t ). Then, by ©, sin(#i) = — sin(#), 
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Fig. 5. After Step 2, the non-target states in the target block acquire negative amplitudes 



that is, 



?i = arcsin [ = sin 8 J . (3) 

\a yt VK I 



Let 02 be the angle between the final state \tp yt ) and \zt) that we want to achieve in Step 2. To determine 
82 we need to do a small calculation. Let X be the sum of the amplitudes of all the states in non-target 
blocks. Then, we have from © that 



(K-l)VN . 

X ~ sm8. 

K 

Let Y denote the sum of the amplitudes of all non-target states in the target block at the end of Step 2. 
We want the overall average amplitude per block (that is, (X + Y)/K) to be half the average in the 
non-target blocks (that is, X/(2(K — 1))); therefore, 

v K ~ 2 Y (K-2)VN . 

Y ~ ; -X ~ smO. 

2(K-l) 2K 



On the other hand, Y = -a yt s'm(e 2 )y / N/K. Thus, 



1 K — 2 

arcsin I sin 8 I . (4) 
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The vector \ip yt ) needs to traverse a total angle of 9\ + 62- In one iteration of A^/k] it covers —j==. 
We thus have an estimate for i^. 



where ® and © give us the values of 6\ and 62 in terms of e. We choose e so that the total number of 
queries, namely, 



h{e) + HeiWN + 1 ~ ( - j (1 - e)VN + ^ 



7T 



1 



1 



arcsm 



+ arcsin 



K a yt VK 
1 K - 



: sim 



2a 



m 



K 



■ sim 



N + l 



is as small as possible. 

Note that with e = 0, the algorithm reduces to the usual database search algorithm and takes (j )v~N) 
queries. Also, for K > 2, the derivative (w.r.t. e) of 

h(e) + e 2 (e), 

is negative at e = 0. It follows that with the optimum choice of e, the running time is bounded by 
f (1 — Ck)VN for some constant Ck > 0. 

We have not been able to obtain general expression for the optimum number of queries by an 
optimum choice of e. For some small values of K, the following table lists the optimum values obtained 
by using a computer program. 





Upper bound 


Lower bound 


Database search 


0.785\/iV 


0.785 VN 


K=2 (first bit) 


0.555^ 


0.23VN 


K=3 (first tcit) 


0.592^ 


0.332VN 


K=4 (first two bits) 




0.393\/JV 


K=5 


0.633^ 


0.4My/N 


K=8 (first three bits) 


0.664^ 


0.508VN 


K=32 (first five bits) 


0.725V-ZV 


0M7VN 



For large values K, one can obtain some estimates on the behavior of Cfe. For example, assume that 
K is large (and N even larger). Take e = Then, we approximate sin 6 by 6 = and bound the 
number of queries by 



7T 

4 



1 



1 



2 7T 

— arcsm — 

7T 4 



7T 



K J 



4 ... but not much easier 



Theorem 2. Fix K. Suppose for all large N, there is an algorithm for the partial search problem that 

1 . 



uses at most ax\N queries and return the correct answer with probability of error 0(N 4 ), Then, 

1 



7T 



<*K > [ J 1 
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Proof. We reduce the database search problem to the partial search problem. First, we derive the 
lower bound assuming that the algorithms for the partial search problem return the correct answer with 
certainty. We start by applying the algorithm for partial search for databases of size N. This yields the 
first log K bits of the target state. Next, we restrict ourselves to those addresses x that have the correct 
first k bits and determine the next k bits of the universe by using the partial search algorithm for databases 
of size N/ K. Continuing in this way, we converge on the target state after making a total of at most 



The reduction for algorithms with errors is similar. We apply the above method until the problem 
size becomes very small (say less than Na). At that point we solve the database search problem by brute 
force. Since, we invoked the partial search problem only 0(log N) times, and each such invocation had 
probability of error at most TV - 12, the probability that all these invocations gave the correct answer is 
1 — 0(N~ 12 log N) . This gives a database search algorithm that gives the correct answer with probability 
1 — 0{N~r2 log N). Now, Theorem |3] in the appendix implies that such an algorithm must make 
jy/~N(l — o(l)) queries to the oracle. A calculation very similar to the one above gives the claimed 
lower bound for olk- □ 

5 Summary 

In yet another variant of the quantum search problem we ask whether it is any easier to partially search 
a database than it is to completely search it. This question is significant, because the search algorithm 
of [4 1 has been shown in [8] to be precisely optimal for the complete search problem. The short answer 
is that partial search is slightly easier. We derive a lower bound indicating how much easier it is and 
an algorithm that closely matches this lower bound. In the appendix, we present a lower bound on the 
expected number of queries made by zero-error randomized algorithms for partial search; we also derive 
an explicit form of Zalka's lower bound for quantum search algorithms that make very small error. 
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A Randomized complexity of partial search 

We are considering algorithms that make no error. To show a lower bound of t queries on the expected 
number of probes made by a randomized algorithm on a worst-case input, it is enough to describe a 
distribution on inputs for which every deterministic algorithm makes at least t queries on the average. 

Let £i, £2, ■ ■ ■ , be the sequence of location this deterministic algorithm probes if f(x) = 0, for all x. 
Now, consider the uniform distribution on inputs obtained by choosing a random location t £ [7Y] and 
setting f(x) = 1 if and only x = t. Let £ denote the event that t is one of £\, £2, . . . ,£n-n/k- Then, 
the probability of £ is exactly 1 — 1/K and conditioned on the event £, the expected number of probes 
made by the deterministic algorithms is exactly £■ (l — ^) . If £ does not hold then, the algorithm makes 
at least 7Y (l — probes (because it is not allowed any errors). Thus, the overall average number of 
probes made by this algorithm is at least 

V K) 2 \ KJK V K ) 2 V K J 



B Zalka 's bound revisited 



In this section we give a detailed proof of the following theorem. 

Theorem 3. Suppose a quantum database search algorithm makes T queries to a database of size 
N > 100 and returns the correct answer with probability at least 1 — e > 0.9. Then, 

i-*£(i-o(v?+jH)). 

To justify this, we will make the arguments in Zalka's paper |8) more explicit and rigorous. Let O y be 
the oracle corresponding to the database where y G [TV] is the only marked element. For t = 0, 1, . . . , T, 
let 

\4>t) be the state of the registers just before the (t + l)-st query is made assuming that all instances of 

the oracle are replaced by the identity transformation; 
\(f)\) be the state of the registers just before the (t + l)-st query is made to the oracle, assuming that the 

oracle is O y . 

Thus, \(f>o) = \(^q) is the initial state and \4>t) and \4> y T ) are the states reached at the end. Like several 
other lower bound proofs, our proof will also consider the variation in the state caused by each query to 
the oracle. To state this, we will denote by \4> y t ,% ) the state of the registers just before the (t + l)-st query 
is made assuming that the first T — i queries are made to the identity oracle and the remaining i queries 
are made to the oracle O y . Thus, \(/)f } = \4>t) and \4>t' T ) = \4>t )• 

It will be convenient to have only real valued amplitudes appearing in our state vectors when they 
are expressed in the computational basis. The standard way to arrange this is by adding an extra qubit 
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register and associating the component (a + ib)\x) appearing in the original space with the vector 
a|x)|0) + 6|x)|l). We will assume that the first register (whose state is a superposition of values in 
[N], when we identify [N] with {0, l} n , this register will consist of n qubits) contains the query made to 
the oracle and also that this address register is measured at the end to recover the answer. Let V be the 
Hilbert space associated with the remaining registers, and let P y be the orthogonal projection operator 
for the subspace \y) <S>V. Note that ||Py|<^)|| 2 is the probability that we observe y when we measure the 
first register in the state | <fi) . 

As in Zalka's argument, we will use angles to measure the distance between (real) unit vectors. Let 
9(<j),(j)') = arccos Note that this distance is always in the range [0, |], and that the triangle 

inequality holds for it. Our proof rests on three lemmas. 

Lemma 1. ^ 9(<p T , 4> V T ) > - (l - O [y~e + AT*)) • 

y e[N] 

Lemma 2. For i = 1, 2, . . . , T, 9(<pj, 1 1 , 4>j, 1 ) < 2 arcsin ^/pT-i : y, where Pr-i,y = \\Py\4>T-i) || 2 is the 
probability that the first address register of\4>T-i) contain the value y. 

Let us assume that these lemmas hold and proceed with the proof of our theorem. Then, 

T-l T-l 

^ 2 arcsin ^ V 0(0ff , <^ i+1 ) (by Lemma© 

ye[N] i=o ye[N] i=0 

> ^2 6{<t> V T Q i 4't T ) (triangle inequality) 

ye[N] 
ye[N] 

> N .l(l-0(y^ + N-tJj . (byLemmaQ} 
On changing the order of summation, we obtain 

T-l 

Y 2axcsin % /p->iV-|(l-o(v^+^"^)) • (5) 

i=0 y£[N] 

Let us consider the inner sum for each value of i. 
Lemma 3. For i = 0, 1, . . . , T — 1, ^ arcsin y/pi iV = V^/V ll + O 

ye[N] ^ 

Now, our theorem follows immediately by using this bound in ©. It remains to prove the lemmas. 
B.l Proofs of the lemmas 

Proof of LemmaU} Recall that 9{4>t,4 > t) = arccos | (^r|0y)|, and P y is the orthogonal projection 
operator onto the subspace \y) <g) V. Since \4>t) is a unit vector, we have ^\ ll-fj/l^r) II 2 < 1> implying 
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By Markov's inequality, for all but a fraction N 4 of the y's in [N], 

\\P v \<fr)\\<N-v. (6) 



On the other hand, because the algorithm errs with probability at most e, we have for all y, 
ll^l^r)!! 2 ^ 1 - e„ and since \\P y \<f> v T ) f + \\{I - P y )\<l) v T )\\ 2 = 1, we conclude that 

- P y )\<j> y T )\\ < V~e- (7) 
By combining © and Q we conclude that for all but an fraction of the y's in [N], 

KH4>l<K^l^r>l + K^rl(^-^)l4>l<^ + ^- 
Let y = aiccos(4>T\4>j<)- We claim that for all but an N~* fraction of the y's in [N], 

e„>|(l-0(e3+JV-i)). (8) 

To justify this, note that since e < ^ and TV > 100, we have ^/e + iV _ 4 < -L (say), and ^ > § . For 
^<0<f,^ = -sin0<-i So, 

(|-*v) x--^=>cos|-cos^>-( % /i + iV-i). 

Our claim ([8ll follows from this. 

Finally, since y > for all y, we have 

= VN (l - N-*) | (l - O (Vl + iV~*)) = Viv| (l-0 (v^ + AT* 



.y 



□ 



Proof of Lemma\2\ It follows from elementary trigonometry that for unit vectors v and w, 

9(v,w) = 2arcsin(- min{||« — w\\, \\v + io||) < 2arcsin(-||u — w\\). 

On the other hand, since the oracle O y differs from the identity transformation only for basis vectors in 
the subspace \y) ® V, one can show that (see, e.g., for a similar derivation) 

#11 < 2||P„|^r-i>||. 

Our lemma follows from these two observations. □ 

Proof of Lemma^ We will show that J2 y arcsin y/pi~y~ achieves its maximum when each pi >y is j^. For, 
let J2 y arcsin y/Pi lV take its maximum value at (pi iV : y G [N]). Now, the function arcsin yfx is concave 

in the interval [0, |] (for its second derivative is — j(l — 2x)(x — x 2 ) 2). Thus, our claim will follow from 
Jensen's inequality if we can show that each p^ y G [0, |]. To show this, suppose for contradiction that 
for some (necessarily unique) y, we have p^ y > \. Then, 



Ell — Pi y N — 1 TT 
arcsin ^/p^ < (N - 1) arcsin W j^—j + arcsin y/Pi$ < (1 + o(±))y — h -. 
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But for large N, we have N arcsin -j= > is larger than this quantity. This contradiction implies 
that our assumption about the existence of y was incorrect. It follows that 

S~] arcsin y/Pi, y < N arcsin —== < Vn (l + O ( — 



where for the first inequality we used the concavity of the function arcsin y/x for x G [0, \] to apply 
Jensen's inequality. □ 
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